conda-cpp-post-build-checks.yaml

on:
  workflow_call:
    inputs:
      build_type:
        description: "One of: [branch, nightly, pull-request]"
        required: true
        type: string
      branch:
        description: |
          Git branch the workflow run targets.
          This is required even when 'sha' is provided because it is also used for organizing artifacts.
        type: string
      date:
        description: "Date (YYYY-MM-DD) this run is for. Used to organize artifacts produced by nightly builds"
        type: string
      sha:
        description: "Full git commit SHA to check out"
        type: string
      repo:
        description: "Git repo to check out, in '{org}/{repo}' form, e.g. 'rapidsai/cudf'"
        type: string
      symbol_exclusions:
        description: |
          Regular expression matching unmangled symbol names to be ignored by this check.
          Should be wrapped in '()' to form a capture group.
          For example, to ignore any function symbols coming from the 'thrust' or 'cub' namespaces,
          you might provide '(void (thrust::|cub::))'.
        type: string
      package_name:
        description: |
          Name of package to use when constructing artifact name using `rapids-artifact-name`, e.g. `libcudf`, `libucxx`
        type: string

defaults:
  run:
    shell: bash

permissions:
  actions: read
  checks: none
  contents: read
  deployments: none
  discussions: none
  id-token: write
  issues: none
  packages: read
  pages: none
  pull-requests: read
  repository-projects: none
  security-events: none
  statuses: none

jobs:
  check-symbols:
    runs-on: linux-amd64-cpu4
    container:
      image: rapidsai/ci-wheel:26.12-latest # zizmor: ignore[unpinned-images]
      env:
        RAPIDS_BUILD_TYPE: ${{ inputs.build_type }}
    steps:
      - uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
        with:
          role-to-assume: ${{ vars.AWS_ROLE_ARN }}
          aws-region: ${{ vars.AWS_REGION }}
          role-duration-seconds: 43200 # 12h
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          repository: ${{ inputs.repo }}
          ref: ${{ inputs.sha }}
          path: "./src/"
          fetch-depth: 0
          persist-credentials: true
      - name: Telemetry setup
        uses: rapidsai/shared-actions/telemetry-dispatch-setup@main
        continue-on-error: true
        if: ${{ vars.TELEMETRY_ENABLED == 'true' }}
        env:
          GH_TOKEN: ${{ github.token }}
      - name: Standardize repository information
        env:
          RAPIDS_REPOSITORY: ${{ inputs.repo || github.repository }}
          RAPIDS_REF_NAME: ${{ inputs.branch || github.ref_name }}
          RAPIDS_NIGHTLY_DATE: ${{ inputs.date }}
        run: |
          {
            echo "RAPIDS_REPOSITORY=${RAPIDS_REPOSITORY}"
            echo "RAPIDS_SHA=$(cd ./src && git rev-parse HEAD)"
            echo "RAPIDS_REF_NAME=${RAPIDS_REF_NAME}"
            echo "RAPIDS_NIGHTLY_DATE=${RAPIDS_NIGHTLY_DATE}"
          } >> "${GITHUB_ENV}"
      # Per the docs at https://docs.github.com/en/rest/rate-limit/rate-limit?apiVersion=2022-11-28#get-rate-limit-status-for-the-authenticated-user,
      # checking '/rate_limit | jq .' should not itself count against any rate limits.
      - name: Check GitHub API rate limits
        run: |
          if ! type gh >/dev/null; then
              echo "'gh' CLI is not installed... skipping rate-limits check"
          else
              gh api /rate_limit | jq .
          fi
        env:
          GH_TOKEN: ${{ github.token }}
      - name: Download conda C++ build artifacts
        env:
          PACKAGE_NAME: ${{ inputs.package_name }}
          REPO: ${{ inputs.repo }}
          GH_TOKEN: ${{ github.token }}
        run: |
          if [ -n "$PACKAGE_NAME" ]; then
            CPP_DIR=$(rapids-download-from-github "$(rapids-artifact-name conda_cpp "$PACKAGE_NAME" "${REPO##*/}" --cuda)")
          else
            CPP_DIR=$(rapids-download-conda-from-github cpp)
          fi
          EXTRACTED_DIR=$(rapids-extract-conda-files "${CPP_DIR}")
          echo "RAPIDS_EXTRACTED_DIR=${EXTRACTED_DIR}" >> "${GITHUB_ENV}"
      - name: Get weak detection tool
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          repository: rapidsai/detect-weak-linking
          ref: refs/heads/main
          path: "./tool/"
          fetch-depth: 0
          persist-credentials: true
      - name: Verify CUDA libraries have no public kernel entry points
        env:
          SYMBOL_EXCLUSIONS: ${{ inputs.symbol_exclusions }}
        run: |
          if [ -n "${SYMBOL_EXCLUSIONS}" ]; then
            python ./tool/detect.py "${RAPIDS_EXTRACTED_DIR}"/lib -e "${SYMBOL_EXCLUSIONS}"
          else
            python ./tool/detect.py "${RAPIDS_EXTRACTED_DIR}"/lib
          fi
      - name: Telemetry upload attributes
        uses: rapidsai/shared-actions/telemetry-dispatch-stash-job-artifacts@main
        continue-on-error: true
        if: ${{ vars.TELEMETRY_ENABLED == 'true' }}
        env:
          GH_TOKEN: ${{ github.token }}